CVE-2026-40425
Medium · 5.7CVSS
5.7
EPSS
0.6%
Published
May 29, 2026
CISA due date
—
The record
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie… CWE-552
- CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display… CWE-552
- CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI… CWE-552
- CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the… CWE-552
- CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated… CWE-552
- CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric Composer… CWE-552
- CVE-2026-82020 Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability… CWE-552
- CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can… CWE-552